THORChain launches recovery proposal after hack: millions of dollars in losses absorbed by the protocol, attacker’s $RUNE destroyed

THORChain suffered a GG20 TSS vulnerability attack on May 15, resulting in approximately $10.7 million in losses. The community has released a recovery proposal, ADR028. The core plan is to absorb the losses first using protocol-owned liquidity (POL), fully forfeit the attacker node’s staked RUNE, and then restart only after the trading functionality is fully repaired and node rotation (Churn) is completed. The network is currently awaiting votes from node operators to decide.
(Background recap: THORChain confirms the treasury vaults were hacked, “losing $10.7 million”! The official emergency suspension of trading; says users’ funds are safe.)
(Additional background: THORChain’s multi-chain synchronization was hacked! $10.8 million evaporated; trading halted across the board; RUNE plunges 12%.)

Table of Contents

Toggle

• Attacker RUNE fully destroyed
• Resume only after fixes
• Frequently Asked Questions

One week after the attack, THORChain rolled out its recovery plan in the form of the ADR028 proposal, bringing the loss handling, security patching, and governance to a vote by node operators.

The proposal includes using protocol-owned liquidity (Protocol-Owned Liquidity, POL) to first absorb the losses caused by this attack. Any portion that cannot be absorbed will be shared proportionally among holders of synthetic assets (Synth); the specific sharing ratios are still being assessed.

This means POL will be temporarily reduced to zero. The proposal suggests that, in the future, some system revenue will be redirected in order to gradually restore POL, step by step, until it is replenished.

Attacker RUNE fully destroyed

For the attacker, the handling leaves no room for ambiguity. Innocent nodes that share the same Asgard vault as the attacker are protected, but the attacker node’s staked RUNE will be forfeited in full. The recovered RUNE will be paired with the assets recovered from the affected vaults. Any excess RUNE after the pairing is completed will be directly burned.

At the same time, THORChain is offering a bounty to the attacker to encourage the return of funds. If some funds are returned, the recovery plan will be rolled back proportionally. The protocol also reiterates its neutrality and permissionless principles. After trading resumes, it will not review the attacker’s Swap operations.

Resume only after fixes

On the technical side, the approach is equally cautious. The current GG20 threshold signature scheme (Threshold Signature Scheme, TSS) will be temporarily retained and patched with upgrades. Trading functionality will not be “turned on first.” Only after the vulnerability is fully repaired and the network successfully completes a Churn (node rotation) will it be restored. In the future, the protocol will also adopt a slower release cadence that places more emphasis on security.

At present, node operators are voting on the overall direction and principles of ADR028. The specific numbers in the proposal are only reference figures for now; later adjustments will be made through the on-chain Mimir voting mechanism. The protocol’s top priority is to restart the network as soon as possible. Voting in favor authorizes the development team to continue pushing forward in this direction.

RUNE has dropped by more than 26% over the past seven days and is currently hovering around $0.43.

Frequently Asked Questions

What is the core content of the THORChain ADR028 proposal?

Use protocol-owned liquidity to absorb the $10.7 million attack loss first, with the remaining amount shared by Synth holders. The attacker node’s staked RUNE will be forfeited in full and any excess will be burned. At the same time, a bounty will be offered to encourage the attacker to return the funds.

When will THORChain’s trading functionality be restored?

It will only be restored after the GG20 TSS vulnerability is fully repaired and the network completes one node rotation (Churn). Node operators are currently voting on the recovery direction; the specific timeline has not been announced yet.